Summary

Question

Customer Environment

Root Cause

Symptoms

• AP will not be able to join SmartZone and in logs you will see device (AP) certificate check failure.
• If you disable the AP cert check on SmartZone, then AP will join but SZ will show you AP certificate expiry alert on the dashboard.

• AP will not join RUCKUS Cloud, as AP certificate check is mandatory.

• AP connection to ZD will not be impacted as ZD uses HTTP by default for the communication, but system will show AP certificate expiry alerts.
•  

• Not applicable

Troubleshooting Steps

Workaround

• Disable AP certificate validation check on SmartZone (not recommended due to security reasons).

• No workaround. Certificate check/validation cannot be disable on RUCKUS Cloud.

• N/A

• N/A

Resolution

Prerequisite: If you are handling certificate(s) for the AP(s) which is/are managed by a RUCKUS controller, make sure AP(s) is/are online on controller when you create the AP certificate request file or restoring the AP certificate resolution file.

Its a 3 step procedure:

Step1: Generate/download the certificate request (.req) file from your Controller/AP.
Step2: Contact RUCKUS support with the certificate request file (.req)
Step3: Support will provide you the certificate resolution file, which you need to upload to the controller/AP.

Below are the steps to for all RUCKUS management platforms to generate the certificate replacement file, and upload the resolution file.

For SmartZone managed APs:

3.4.x

1-2. Login to SZ Web UI >> Administration >> AP Certificate Replacement
3-5. Check if there are any APs with Update Pending Update failed status >> Select the AP(s) from the list of pending cert update APs >> Export the request file (.req)
6. Open a case with Support and provide the .req file, they will process it and provide you the .res file.
7-9. Click on "Import AP certificate response (.rs) file" >> Brows the .res file and hit apply.
10. You can review the cert upload status under "Certificate Status".

Note: Ignore the Strikethrough text in the above screenshot, it is no longer applicable.

3.5.x, 3.6.x, 5.x and above

1. Only AP Certificate replacement page location is changed, rest of the steps are same as 3.4.x.
2. Page is now located under System >> Certificates >>  AP Certificate Replacement

6.x and above

1. Starting from 6.0 SZ web UI was changed so look and feel is different, AP Certificate Replacement page now located under Administration >> Certificates >> AP Certificate Replacement. Rest of the process is same as 3.4.x and 3.5.x. 

For ZoneDirector managed APs

9.13.x

1. Login to ZD Web UI and go to Configure >> Certificate >> Advanced Options >> Import RUCKUS PKI Certificate Package
2. To generate RUCKUS PKI certificate request, please input the valid number of APs whose certificate should be updated and click on "click here" link. (Range: 0~100, 0 means ALL)
3. Step two will generate and download a '.req' file "<ZD_DEVICE_NAME>_rpki_cert_request.req".
4. Open a case with Support with the .req file and they will provide you the .res file.
5. Once you get the .res file, upload it to ZD by clocking on "Choose File" button and ZD will process the file and apply the certificate to the AP(s).

10.x

1. Process is same as 9.13.x, only web UI look and feel is different.

For standalone APs

1. Login to AP web UI and go to Administration >> Management >> Certificate Verification >> Click on "Request to reissue a new certificate". This will download a request file (.req).
2. Contact RUCKUS support with the request file and Support will provide you the resolution(.res) file.
3. Now go to Maintenance >> Upgrade >> Select "Local" >> Device Certificate >> Choose the file (.res file which you have received from Support) >> Upload the certificate.